{"id":53412,"date":"2025-09-22T13:19:01","date_gmt":"2025-09-22T13:19:01","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=53412"},"modified":"2025-09-22T13:19:01","modified_gmt":"2025-09-22T13:19:01","slug":"how-to-validate-upi-paytm-payment-qr-codes-programmatically-step-by-step-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/how-to-validate-upi-paytm-payment-qr-codes-programmatically-step-by-step-guide\/","title":{"rendered":"How to Validate UPI & Paytm Payment QR Codes Programmatically (Step-by-Step Guide"},"content":{"rendered":"\n

Great question. You can validate \u201cpayment QR codes\u201d at two levels<\/strong>:<\/p>\n\n\n\n

    \n
  1. Decode & structural checks (what you can do locally in code)<\/strong><\/li>\n\n\n\n
  2. Live verification (needs a PSP\/gateway API; optional but best-practice)<\/strong><\/li>\n<\/ol>\n\n\n\n

    Below is a practical, copy-pasteable approach you can drop into your stack (PHP\/Laravel, plus quick Node\/Python snippets).<\/p>\n\n\n\n

    \n\n\n\n

    1) What kinds of payment QR payloads you\u2019ll see<\/h1>\n\n\n\n
      \n
    • UPI intent URI<\/strong> (most common; including Paytm VPAs)
      Example:
      upi:\/\/pay?pa=merchant@paytm&pn=Acme+Store&am=123.45&cu=INR&tn=Order+123<\/code><\/li>\n\n\n\n
    • EMVCo \/ BharatQR TLV string<\/strong> (starts with digits)
      Example:
      000201010211...5303561540...6304ABCD<\/code> (ends with CRC \u201c63 04 XXXX\u201d)<\/li>\n\n\n\n
    • Wallet\/app-specific deep links<\/strong>\n
        \n
      • Paytm: upi:\/\/pay?...<\/code> or<\/strong> paytmmp:\/\/...<\/code> or<\/strong> short URL like https:\/\/paytm.me\/...<\/code>
        (Most Paytm merchant QRs are actually UPI with a Paytm VPA such as ...@paytm<\/code>.)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n

        2) Flow to implement<\/h1>\n\n\n\n

        A. Decode the QR image \u2192 get the raw text<\/strong><\/p>\n\n\n\n

          \n
        • PHP: khanamiryan\/qrcode-detector-decoder<\/code> (ZXing port)<\/li>\n\n\n\n
        • Node: @zxing\/library<\/code>, jsqr<\/code><\/li>\n\n\n\n
        • Python: pyzbar<\/code> or opencv<\/code> + zbarlight<\/code><\/li>\n<\/ul>\n\n\n\n

          B. Decide the type & validate structurally<\/strong><\/p>\n\n\n\n

            \n
          • If it starts with upi:\/\/pay<\/code><\/strong> \u2192 parse as URI, validate required params.<\/li>\n\n\n\n
          • If it looks like TLV (digits, starts with \u201c00 02 01 02 11 \u2026\u201d etc.)<\/strong> \u2192 parse TLV and verify CRC16-CCITT<\/strong> in tag 63<\/code>.<\/li>\n\n\n\n
          • If it\u2019s app link<\/strong> (paytmmp:\/\/<\/code> or https:\/\/paytm.me\/...<\/code>) \u2192 allowlist the scheme\/domain and (optionally) resolve server-side to ensure it\u2019s a valid, reachable link owned by Paytm.<\/li>\n<\/ul>\n\n\n\n

            C. (Optional but recommended) Live verification<\/strong><\/p>\n\n\n\n

              \n
            • You cannot<\/strong> guarantee a VPA exists or is active from the QR alone.<\/li>\n\n\n\n
            • Use a PSP\/gateway that exposes VPA verification<\/strong> (aka \u201cUPI PSP lookup\u201d) APIs:\n
                \n
              • Razorpay, Cashfree, Paytm for Business, PhonePe, Juspay, etc.<\/li>\n\n\n\n
              • Typically you send pa=merchant@bank<\/code> to an endpoint \u2192 they reply if it\u2019s valid and sometimes return the account holder name.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                \n\n\n\n

                3) Validation rules (UPI intent)<\/h1>\n\n\n\n

                For upi:\/\/pay<\/code> links:<\/p>\n\n\n\n

                  \n
                • Scheme<\/strong> must be upi<\/code>, host<\/strong> must be pay<\/code><\/li>\n\n\n\n
                • Required<\/strong>:\n
                    \n
                  • pa<\/code> (VPA): ^[a-zA-Z0-9.\\-_]{2,}@[a-zA-Z0-9.\\-_]{2,}$<\/code><\/li>\n\n\n\n
                  • cu<\/code> (currency): usually INR<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
                  • Common\/optional<\/strong>: pn<\/code> (payee name), am<\/code> (amount), tn<\/code> (note), tr<\/code> (txn ref), tid<\/code>, mc<\/code> (merchant code), orgid<\/code>, sign<\/code> (signed intents)<\/li>\n\n\n\n
                  • If you require fixed amount<\/strong> QRs, ensure am<\/code> is present and numeric (^\\d+(\\.\\d{1,2})?$<\/code>).<\/li>\n\n\n\n
                  • Reject unknown params if you want a strict policy, or allow a whitelist (pa,pn,am,tn,tr,tid,mc,cu,orgid,sign,mode<\/code>).<\/li>\n<\/ul>\n\n\n\n
                    \n\n\n\n

                    4) Validation rules (EMVCo\/BharatQR TLV)<\/h1>\n\n\n\n
                      \n
                    • TLV format: <TAG><LEN><VALUE><\/code> repeated, all numeric.<\/li>\n\n\n\n
                    • CRC<\/strong> is tag 63<\/code> with length 04<\/code>. Compute CRC16-CCITT (0x1021, init 0xFFFF)<\/strong> over the bytes up to but not including<\/strong> the CRC value, then compare with the provided 4-hex checksum.<\/li>\n\n\n\n
                    • Presence of specific tags depends on the profile (UPI merchant, etc.). For basic acceptance, verifying a correct TLV structure + CRC already weeds out malformed codes.<\/li>\n<\/ul>\n\n\n\n
                      \n\n\n\n

                      5) PHP (Laravel-friendly) samples<\/h1>\n\n\n\n

                      A) Decode the QR<\/h2>\n\n\n
                      composer require<\/span> khanamiryan\/qrcode-detector-decoder\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n
                      use<\/span> Zxing<\/span>\\QrReader<\/span>;\n\nfunction<\/span> decodeQrImage<\/span>(string $path)<\/span>: ?string<\/span> <\/span>{\n    $qrcode = new<\/span> QrReader($path); \/\/ supports JPG\/PNG, etc.<\/span>\n    $text = $qrcode->text();\n    return<\/span> $text !== ''<\/span> ? $text : null<\/span>;\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      B) Validate UPI intent URI<\/h2>\n\n\n
                      function<\/span> isValidUpiUri<\/span>(string $s)<\/span>: bool<\/span> <\/span>{\n    \/\/ quick precheck<\/span>\n    if<\/span> (!str_starts_with($s, 'upi:\/\/pay'<\/span>)) return<\/span> false<\/span>;\n\n    $parts = parse_url($s);\n    if<\/span> (($parts['scheme'<\/span>] ?? ''<\/span>) !== 'upi'<\/span>) return<\/span> false<\/span>;\n    if<\/span> (($parts['host'<\/span>] ?? ''<\/span>) !== 'pay'<\/span>) return<\/span> false<\/span>;\n\n    parse_str($parts['query'<\/span>] ?? ''<\/span>, $q);\n\n    \/\/ Required fields<\/span>\n    if<\/span> (empty<\/span>($q['pa'<\/span>]) || empty<\/span>($q['cu'<\/span>])) return<\/span> false<\/span>;\n\n    \/\/ VPA pattern (basic)<\/span>\n    if<\/span> (!preg_match('\/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+$\/'<\/span>, $q['pa'<\/span>])) return<\/span> false<\/span>;\n\n    \/\/ Currency<\/span>\n    if<\/span> (strtoupper($q['cu'<\/span>]) !== 'INR'<\/span>) return<\/span> false<\/span>;\n\n    \/\/ Amount (if present)<\/span>\n    if<\/span> (isset<\/span>($q['am'<\/span>]) && !preg_match('\/^\\d+(\\.\\d{1,2})?$\/'<\/span>, $q['am'<\/span>])) return<\/span> false<\/span>;\n\n    \/\/ Optional: enforce allowlist of params<\/span>\n    $allowed = ['pa'<\/span>,'pn'<\/span>,'am'<\/span>,'tn'<\/span>,'tr'<\/span>,'tid'<\/span>,'mc'<\/span>,'cu'<\/span>,'orgid'<\/span>,'sign'<\/span>,'mode'<\/span>];\n    foreach<\/span> (array_keys($q) as<\/span> $k) {\n        if<\/span> (!in_array($k, $allowed, true<\/span>)) return<\/span> false<\/span>; \/\/ tighten as you prefer<\/span>\n    }\n\n    return<\/span> true<\/span>;\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      C) Detect & validate EMVCo\/BharatQR TLV (CRC check)<\/h2>\n\n\n
                      function<\/span> looksLikeTlv<\/span>(string $s)<\/span>: bool<\/span> <\/span>{\n    return<\/span> ctype_digit($s) && strlen($s) >= 8<\/span>; \/\/ rough heuristic<\/span>\n}\n\nfunction<\/span> parseTlv<\/span>(string $s)<\/span>: array<\/span> <\/span>{\n    $i = 0<\/span>; $fields = [];\n    while<\/span> ($i + 4<\/span> <= strlen($s)) {\n        $tag = substr($s, $i, 2<\/span>); $i += 2<\/span>;\n        $len = intval(substr($s, $i, 2<\/span>)); $i += 2<\/span>;\n        $val = substr($s, $i, $len); $i += $len;\n        $fields[$tag] = $val;\n        if<\/span> ($i > strlen($s)) break<\/span>;\n    }\n    return<\/span> $fields;\n}\n\n\/\/ CRC16-CCITT (0x1021), init 0xFFFF, no xorout<\/span>\nfunction<\/span> crc16_ccitt<\/span>(string $data)<\/span>: string<\/span> <\/span>{\n    $crc = 0xFFFF<\/span>;\n    $bytes = unpack('C*'<\/span>, $data);\n    foreach<\/span> ($bytes as<\/span> $b) {\n        $crc ^= ($b << 8<\/span>);\n        for<\/span> ($i=0<\/span>; $i<8<\/span>; $i++) {\n            $crc = ($crc & 0x8000<\/span>) ? (($crc << 1<\/span>) ^ 0x1021<\/span>) : ($crc << 1<\/span>);\n            $crc &= 0xFFFF<\/span>;\n        }\n    }\n    return<\/span> strtoupper(str_pad(dechex($crc), 4<\/span>, '0'<\/span>, STR_PAD_LEFT));\n}\n\nfunction<\/span> isValidEmvcoWithCrc<\/span>(string $s)<\/span>: bool<\/span> <\/span>{\n    if<\/span> (!looksLikeTlv($s)) return<\/span> false<\/span>;\n    \/\/ Find CRC tag \"63\"<\/span>\n    $pos = strpos($s, '63'<\/span>);\n    if<\/span> ($pos === false<\/span>) return<\/span> false<\/span>;\n\n    \/\/ The CRC field is \"63 04 XXXX\"<\/span>\n    $crcFieldStart = $pos;\n    $dataForCrc = substr($s, 0<\/span>, $crcFieldStart + 4<\/span>); \/\/ include \"63\" + \"04\", exclude the 4 hex CRC value<\/span>\n    $providedCrc = substr($s, $crcFieldStart + 4<\/span>, 4<\/span>);\n    \/\/ Compute CRC over the raw bytes, which here are ASCII digits; this simplified check is<\/span>\n    \/\/ acceptable for gating malformed QRs. For production, convert TLV to actual bytes.<\/span>\n    $calc = crc16_ccitt($dataForCrc);\n    return<\/span> strtoupper($providedCrc) === $calc;\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      D) Putting it together<\/h2>\n\n\n
                      function<\/span> validatePaymentQr<\/span>(string $imagePath)<\/span>: array<\/span> <\/span>{\n    $raw = decodeQrImage($imagePath);\n    if<\/span> ($raw === null<\/span>) {\n        return<\/span> ['ok'<\/span> => false<\/span>, 'type'<\/span> => null<\/span>, 'reason'<\/span> => 'QR not readable'<\/span>];\n    }\n\n    \/\/ UPI intent?<\/span>\n    if<\/span> (isValidUpiUri($raw)) {\n        return<\/span> ['ok'<\/span> => true<\/span>, 'type'<\/span> => 'upi-intent'<\/span>, 'payload'<\/span> => $raw];\n    }\n\n    \/\/ EMVCo TLV with valid CRC?<\/span>\n    if<\/span> (looksLikeTlv($raw) && isValidEmvcoWithCrc($raw)) {\n        return<\/span> ['ok'<\/span> => true<\/span>, 'type'<\/span> => 'emvco-tlv'<\/span>, 'payload'<\/span> => $raw];\n    }\n\n    \/\/ Paytm deep links (allowlist)<\/span>\n    if<\/span> (str_starts_with($raw, 'paytmmp:\/\/'<\/span>) || str_starts_with($raw, 'https:\/\/paytm.me\/'<\/span>)) {\n        return<\/span> ['ok'<\/span> => true<\/span>, 'type'<\/span> => 'paytm-link'<\/span>, 'payload'<\/span> => $raw];\n    }\n\n    return<\/span> ['ok'<\/span> => false<\/span>, 'type'<\/span> => null<\/span>, 'reason'<\/span> => 'Unknown or malformed payment QR'<\/span>];\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      \n\n\n\n
                      6) Node & Python quickies<\/h1>\n\n\n\n
                      Node (decode + basic UPI check)<\/strong><\/p>\n\n\n
                      npm<\/span> i<\/span> @zxing<\/span>\/library\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n
                      const<\/span> { BrowserQRCodeReader } = require<\/span>('@zxing\/library'<\/span>);\n\nfunction<\/span> isValidUpiUri<\/span>(s<\/span>) <\/span>{\n  try<\/span> {\n    const<\/span> u = new<\/span> URL(s);\n    if<\/span> (u.protocol !== 'upi:'<\/span> || u.hostname !== 'pay'<\/span>) return<\/span> false<\/span>;\n    const<\/span> pa = u.searchParams.get('pa'<\/span>);\n    const<\/span> cu = u.searchParams.get('cu'<\/span>);\n    if<\/span> (!pa || !\/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+$\/<\/span>.test(pa)) return<\/span> false<\/span>;\n    if<\/span> ((cu || ''<\/span>).toUpperCase() !== 'INR'<\/span>) return<\/span> false<\/span>;\n    const<\/span> am = u.searchParams.get('am'<\/span>);\n    if<\/span> (am && !\/^\\d+(\\.\\d{1,2})?$\/<\/span>.test(am)) return<\/span> false<\/span>;\n    return<\/span> true<\/span>;\n  } catch<\/span> { return<\/span> false<\/span>; }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                      Python (pyzbar)<\/strong><\/p>\n\n\n
                      pip install pyzbar pillow\n<\/code><\/span><\/pre>\n\n
                      from<\/span> pyzbar.pyzbar import<\/span> decode\nfrom<\/span> PIL import<\/span> Image\nfrom<\/span> urllib.parse import<\/span> urlparse, parse_qs\n\ndef is_valid_upi_uri(s: str) -> bool:\n    try<\/span>:\n        u = urlparse(s)\n        if<\/span> u.scheme != 'upi'<\/span> or u.netloc != 'pay'<\/span>: return<\/span> False\n        q = {k<\/span>:v[0<\/span>] for<\/span> k,v in<\/span> parse_qs(u.query).items()}\n        pa = q.get('pa'<\/span>); cu = (q.get('cu'<\/span>) or ''<\/span>).upper()\n        if<\/span> not pa or not cu: return<\/span> False\n        import<\/span> re\n        if<\/span> not re.match(r'^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+$'<\/span>, pa): return<\/span> False\n        if<\/span> cu != 'INR'<\/span>: return<\/span> False\n        am = q.get('am'<\/span>)\n        if<\/span> am and not re.match(r'^\\d+(\\.\\d{1,2})?$'<\/span>, am): return<\/span> False\n        return<\/span> True\n    except<\/span>:\n        return<\/span> False\n\ndef decode_qr(path: str) -> str | None:\n    d = decode(Image.open(path))\n    return<\/span> d[0<\/span>].data.decode() if<\/span> d else<\/span> None\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                      \n\n\n\n
                      7) Security & product tips<\/h1>\n\n\n\n
                        \n
                      • Don\u2019t auto-trust<\/strong> a decoded string just because it parses. Enforce strict allowlists<\/strong> (schemes, hosts, param names).<\/li>\n\n\n\n
                      • Sanitize & log<\/strong> the original payload for audit\/debug.<\/li>\n\n\n\n
                      • Optionally<\/strong>: if you only accept merchant (fixed-amount) QRs<\/strong>, reject those missing am<\/code>.<\/li>\n\n\n\n
                      • Live verification<\/strong>: integrate a PSP\u2019s VPA validation<\/strong> API to confirm the VPA exists and is active before saving the QR to your database.<\/li>\n\n\n\n
                      • Rate-limit<\/strong> and virus-scan uploads; store images in a safe bucket; validate mime & dimensions<\/strong>.<\/li>\n\n\n\n
                      • UX<\/strong>: after upload, show the decoded details (VPA, name, amount) back to the user for confirmation.<\/li>\n<\/ul>\n\n\n\n
                        \n\n\n\n
                        If you want something that is widely used in production and proven to work across banks, UPI apps, and wallets like Paytm<\/strong>, then the industry practice is:<\/p>\n\n\n\n
                        \u2705 Most Widely Accepted Implementation<\/h3>\n\n\n\n
                          \n
                        • UPI intent URI validation + (optionally) EMVCo TLV validation + VPA verification via PSP APIs.<\/strong><\/li>\n\n\n\n
                        • Almost all real-world QR codes in India today (Paytm, PhonePe, GPay, BHIM, BharatPe, banks) follow the NPCI UPI QR Standard<\/strong> which is based on EMVCo QR<\/strong> but typically presented as a upi:\/\/pay?...<\/code> intent.<\/li>\n\n\n\n
                        • So, in practice:\n
                            \n
                          1. Decode the QR \u2192 you\u2019ll almost always get upi:\/\/pay?...<\/code><\/strong><\/li>\n\n\n\n
                          2. Check required fields (pa<\/code>, cu<\/code>) + format (VPA regex, currency = INR)<\/strong><\/li>\n\n\n\n
                          3. (Optional but best) Call a PSP\/aggregator API to confirm the VPA is valid<\/strong><\/li>\n<\/ol>\n<\/li>\n<\/ul>\n\n\n\n
                            \n\n\n\n
                            \ud83d\ude80 Why this is the standard<\/h3>\n\n\n\n
                              \n
                            • Banks & UPI apps<\/strong> interoperate because NPCI mandated UPI intent URIs and EMVCo QR as the backbone.<\/li>\n\n\n\n
                            • Paytm merchant QRs<\/strong> are just UPI QR with VPAs ending in @paytm<\/code>.<\/li>\n\n\n\n
                            • PhonePe, GPay, Amazon Pay, BHIM<\/strong> \u2192 all issue UPI QR codes in the same format.<\/li>\n\n\n\n
                            • Even BharatQR (card+UPI) is EMVCo TLV under the hood, but most merchant-facing QRs still decode to a UPI intent.<\/li>\n<\/ul>\n\n\n\n
                              \n\n\n\n
                              \ud83d\udd11 So in your system<\/h3>\n\n\n\n
                                \n
                              • Implement UPI intent URI parsing & validation<\/strong> (like the PHP\/Python snippets I showed).<\/li>\n\n\n\n
                              • Treat Paytm links<\/strong> as a special-case allowlist (if you want to support their paytmmp:\/\/<\/code> or https:\/\/paytm.me\/...<\/code>).<\/li>\n\n\n\n
                              • If you want bulletproof validation (to avoid fake VPAs), plug into a PSP\u2019s VPA verification API<\/strong> (Razorpay, Paytm for Business, Cashfree, PhonePe, Juspay all provide it).<\/li>\n<\/ul>\n\n\n\n
                                \n\n\n\n
                                \ud83d\udc49 In short:
                                Decode QR \u2192 Validate UPI intent URI \u2192 (optional) Live VPA verification API.<\/strong>
                                That\u2019s the widely accepted, real-world working approach<\/strong> used by payment apps and fintech companies.<\/p>\n\n\n\n
                                \n\n\n\n
                                <\/p>\n","protected":false},"excerpt":{"rendered":"
                                Great question. You can validate \u201cpayment QR codes\u201d at two levels: Below is a practical, copy-pasteable approach you can drop into your stack (PHP\/Laravel, plus quick Node\/Python snippets). 1) What… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-53412","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=53412"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53412\/revisions"}],"predecessor-version":[{"id":53413,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53412\/revisions\/53413"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=53412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=53412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=53412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}